Timeline for Is allowing unfiltered curl request from a website a vulnerability?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 5, 2015 at 15:11 | comment | added | billc.cn | Depending on how it passes parameters, you might be able to make the website load itself in an infinite loop... Self Denial of Service? | |
| Aug 3, 2015 at 8:12 | comment | added | SilverlightFox |
@user10008: It is not meant to be public to the whole world - only to interactive users of the system (e.g. terminal access by an employee running the service). Grabbing /etc/passwd can be used as a POC that a file access vulnerability exists.
|
|
| Aug 2, 2015 at 9:04 | vote | accept | Samuel | ||
| Aug 2, 2015 at 9:02 | comment | added | Samuel | @mucaho I will if I find the page. Of course I won't try to verify the exploits as RоryMcCune pointed out it may be subject to local laws. | |
| Aug 2, 2015 at 5:45 | history | tweeted | twitter.com/#!/StackSecurity/status/627716862575538176 | ||
| Aug 1, 2015 at 23:52 | comment | added | user10008 | Note: /etc/passwd is meant to be public. Private data is in /etc/shadow. | |
| Aug 1, 2015 at 22:04 | comment | added | mucaho | I'd appreciate it if you inform them about the potential security risk! | |
| Aug 1, 2015 at 19:42 | answer | added | Cristian Dobre | timeline score: 16 | |
| Aug 1, 2015 at 15:52 | answer | added | Rory McCune | timeline score: 9 | |
| Aug 1, 2015 at 15:07 | history | edited | user45139 | CC BY-SA 3.0 |
added 5 characters in body
|
| Aug 1, 2015 at 14:05 | history | asked | Samuel | CC BY-SA 3.0 |